Pennysia Users Urged to Revoke Approvals After Exploit

Blockchain security firm SlowMist urged users of Pennysia's Ethereum swap service to revoke token-spending permissions after an attacker exploited its Settlement contract to take assets from wallets that had previously authorized it.

The Nov. 12 attack transaction moved about 5,006 USDC, 0.05 wstETH and 101,000 YUNo.finance (YUNO) tokens from four addresses. Etherscan's transfer list shows the assets passing through Settlement and an intermediary contract to the address SlowMist identified as the attacker. Those amounts cover the cited transaction, not a verified incident-wide loss total.

A separate onchain transaction disabled swaps later on Nov. 12, before SlowMist's Nov. 13 public warning. Etherscan's read-contract panel still showed swaps disabled on Nov. 14.

Old Approvals, Not Pool Deposits

Pennysia's documentation describes Settlement as a router that pulls the token a user wants to sell and routes trades to external venues, rather than a liquidity pool holding trading inventory.

SlowMist said an “arbitrary external call” — an attacker-chosen call to another contract — allowed the attacker to spend tokens using approvals users had left in place. These permissions authorize a contract to move tokens from a wallet; users do not have to keep funds deposited in Settlement for an approval to matter.

SlowMist identified the affected Ethereum spender as:

0x3aad97e5a91b8e43b7dc830aceb004307678795e

Users who previously approved that address should check for remaining allowances and revoke them, following SlowMist's warning. Etherscan's token approval tool lets wallet owners review and revoke permissions for a specific spender. The swap pause does not cancel those permissions. The number of wallets with approvals still outstanding, and the balances they cover, have not been verified.

Pennysia's status page displayed “All Systems Operational” and “No incidents reported in the last 14 days” when checked on Nov. 14.